librex 0.0.16 → 0.0.17

data/lib/rex/proto/ntlm.rb.ut.rb

@@ -0,0 +1,177 @@
+#!/usr/bin/env ruby
+require 'test/unit'
+require 'rex/proto/ntlm'
+require 'rex/socket'
+
+class ConnectionTest < Test::Unit::TestCase
+	def setup
+		@user = "admin"
+		@pass = "1234"
+		@domain = ""
+		@host = "192.168.145.161"
+	end
+
+	def test_socket_connectivity
+		assert_nothing_raised do
+			socket = Rex::Socket.create_tcp(
+				'PeerHost' => @host,
+				'PeerPort' => 80
+			)
+			assert_kind_of Socket, socket
+			assert !socket.closed?
+			socket.close
+			assert socket.closed?
+		end
+	end
+
+	def http_message(msg)
+		get_req = "GET / HTTP/1.1\r\n"
+		get_req += "Host: #{@host}\r\n"
+		get_req += "User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)\r\n"
+		get_req += "Authorization: NTLM #{msg.encode64}\r\n"
+		get_req += "Content-type: application/x-www-form-urlencoded\r\n"
+		get_req += "Content-Length: 0\r\n"
+		get_req += "\r\n"
+	end
+
+	def client_auth(pw)
+		msg_1 = Rex::Proto::NTLM::Message::Type1.new
+		get_req = http_message(msg_1)
+		socket = Rex::Socket.create_tcp(
+			'PeerHost' => @host,
+			'PeerPort' => 80
+		)
+		socket.put get_req
+		res = socket.get(3)
+		assert res =~ /WWW-Authenticate: NTLM TlRM/
+			res_ntlm = res.match(/WWW-Authenticate: NTLM ([A-Z0-9\x2b\x2f=]+)/i)[1]
+		assert_operator res_ntlm.size, :>=, 24
+		msg_2 = Rex::Proto::NTLM::Message.decode64(res_ntlm)
+		assert msg_2
+		msg_3 = msg_2.response({:user => @user, :password => pw}, {:ntlmv2 => true})
+		assert msg_3
+		auth_req = http_message(msg_3)
+		socket.put auth_req
+		auth_res = socket.get(3)
+		socket.close
+		return auth_res
+	end
+
+	def test_client_auth_success
+		assert_equal client_auth(@pass)[0,12], "HTTP/1.1 200"
+	end
+
+	def test_client_auth_fail
+		assert_not_equal client_auth("badpass")[0,12], "HTTP/1.1 200"
+		assert_equal client_auth("badpass")[0,12], "HTTP/1.1 401"
+	end
+end
+
+# FunctionTest by Minero Aoki
+
+class FunctionTest < Test::Unit::TestCase #:nodoc:
+	def setup
+		@passwd = "SecREt01"
+		@user   = "user"
+		@domain = "domain"
+		@challenge = ["0123456789abcdef"].pack("H*")
+		@client_ch = ["ffffff0011223344"].pack("H*")
+		@timestamp = 1055844000
+		@trgt_info = [
+			"02000c0044004f004d00410049004e00" +
+			"01000c00530045005200560045005200" +
+			"0400140064006f006d00610069006e00" +
+			"2e0063006f006d000300220073006500" +
+			"72007600650072002e0064006f006d00" +
+			"610069006e002e0063006f006d000000" +
+			"0000"
+		].pack("H*")
+	end
+
+	def test_lm_hash
+		ahash = ["ff3750bcc2b22412c2265b23734e0dac"].pack("H*")
+		assert_equal ahash, Rex::Proto::NTLM::Crypt::lm_hash(@passwd)
+	end
+
+	def test_ntlm_hash
+		ahash = ["cd06ca7c7e10c99b1d33b7485a2ed808"].pack("H*")
+		assert_equal ahash, Rex::Proto::NTLM::Crypt::ntlm_hash(@passwd)
+	end
+
+	def test_ntlmv2_hash
+		ahash = ["04b8e0ba74289cc540826bab1dee63ae"].pack("H*")
+		assert_equal ahash, Rex::Proto::NTLM::Crypt::ntlmv2_hash(@user, @passwd, @domain)
+	end
+
+	def test_lm_response
+		ares = ["c337cd5cbd44fc9782a667af6d427c6de67c20c2d3e77c56"].pack("H*")
+		assert_equal ares, Rex::Proto::NTLM::Crypt::lm_response(
+			{
+			:lm_hash => Rex::Proto::NTLM::Crypt::lm_hash(@passwd),
+			:challenge => @challenge
+		}
+		)
+	end
+
+	def test_ntlm_response
+		ares = ["25a98c1c31e81847466b29b2df4680f39958fb8c213a9cc6"].pack("H*")
+		ntlm_hash = Rex::Proto::NTLM::Crypt::ntlm_hash(@passwd)
+		assert_equal ares, Rex::Proto::NTLM::Crypt::ntlm_response(
+			{
+			:ntlm_hash => ntlm_hash,
+			:challenge => @challenge
+		}
+		)
+	end
+
+	def test_lmv2_response
+		ares = ["d6e6152ea25d03b7c6ba6629c2d6aaf0ffffff0011223344"].pack("H*")
+		assert_equal ares, Rex::Proto::NTLM::Crypt::lmv2_response(
+			{
+			:ntlmv2_hash => Rex::Proto::NTLM::Crypt::ntlmv2_hash(@user, @passwd, @domain),
+			:challenge => @challenge
+		},
+			{ :client_challenge => @client_ch }
+		)
+	end
+
+	def test_ntlmv2_response
+		ares = [
+			"cbabbca713eb795d04c97abc01ee4983" +
+			"01010000000000000090d336b734c301" +
+			"ffffff00112233440000000002000c00" +
+			"44004f004d00410049004e0001000c00" +
+			"53004500520056004500520004001400" +
+			"64006f006d00610069006e002e006300" +
+			"6f006d00030022007300650072007600" +
+			"650072002e0064006f006d0061006900" +
+			"6e002e0063006f006d00000000000000" +
+			"0000"
+		].pack("H*")
+		assert_equal ares, Rex::Proto::NTLM::Crypt::ntlmv2_response(
+			{
+			:ntlmv2_hash => Rex::Proto::NTLM::Crypt::ntlmv2_hash(@user, @passwd, @domain),
+			:challenge => @challenge,
+			:target_info => @trgt_info
+		},
+			{
+			:timestamp => @timestamp,
+			:client_challenge => @client_ch
+		}
+		)
+	end
+
+	def test_ntlm2_session
+		acha = ["ffffff001122334400000000000000000000000000000000"].pack("H*")
+		ares = ["10d550832d12b2ccb79d5ad1f4eed3df82aca4c3681dd455"].pack("H*")
+		session = Rex::Proto::NTLM::Crypt::ntlm2_session(
+			{
+			:ntlm_hash => Rex::Proto::NTLM::Crypt::ntlm_hash(@passwd),
+			:challenge => @challenge
+		},
+			{ :client_challenge => @client_ch }
+		)
+		assert_equal acha, session[0]
+		assert_equal ares, session[1]
+	end
+end

data/lib/rex/proto/ntlm/base.rb

@@ -0,0 +1,326 @@
+#
+# An NTLM Authentication Library for Ruby
+#
+# This code is a derivative of "dbf2.rb" written by yrock
+# and Minero Aoki. You can find original code here:
+# http://jp.rubyist.net/magazine/?0013-CodeReview
+# -------------------------------------------------------------
+# Copyright (c) 2005,2006 yrock
+# 
+# This program is free software.
+# You can distribute/modify this program under the terms of the
+# Ruby License.
+#
+# 2011-02-23 refactored by Alexandre Maloteaux for Metasploit Project
+# -------------------------------------------------------------
+#
+# 2006-02-11 refactored by Minero Aoki
+# -------------------------------------------------------------
+#
+# All protocol information used to write this code stems from
+# "The NTLM Authentication Protocol" by Eric Glass. The author 
+# would thank to him for this tremendous work and making it 
+# available on the net.
+# http://davenport.sourceforge.net/ntlm.html
+# -------------------------------------------------------------
+# Copyright (c) 2003 Eric Glass
+#
+# Permission to use, copy, modify, and distribute this document
+# for any purpose and without any fee is hereby granted,
+# provided that the above copyright notice and this list of
+# conditions appear in all copies. 
+# -------------------------------------------------------------
+#
+# The author also looked Mozilla-Firefox-1.0.7 source code,
+# namely, security/manager/ssl/src/nsNTLMAuthModule.cpp and
+# Jonathan Bastien-Filiatrault's libntlm-ruby.
+# "http://x2a.org/websvn/filedetails.php?
+# repname=libntlm-ruby&path=%2Ftrunk%2Fntlm.rb&sc=1"
+# The latter has a minor bug in its separate_keys function.
+# The third key has to begin from the 14th character of the 
+# input string instead of 13th:)
+#--
+# $Id: ntlm.rb 11678 2011-01-30 19:26:35Z hdm $
+#++
+
+#this class defines the base type needed for other modules like message and crypt
+
+require 'rex/proto/ntlm/constants'
+
+module Rex
+module Proto
+module NTLM
+class Base
+
+CONST = Rex::Proto::NTLM::Constants
+
+   	# base classes for primitives
+   	class Field
+	     	attr_accessor :active, :value
+
+		def initialize(opts)
+			@value  = opts[:value]
+			@active = opts[:active].nil? ? true : opts[:active]
+		end
+	      
+		def size
+			@active ? @size : 0
+		end
+	end
+	
+	class String < Field
+		def initialize(opts)
+			super(opts)
+			@size = opts[:size]
+		end
+	      
+		def parse(str, offset=0)
+			if @active and str.size >= offset + @size
+				@value = str[offset, @size]
+				@size
+			else
+				0
+			end
+		end
+	      
+		def serialize
+			if @active
+				@value
+			else
+				""
+			end
+		end
+	      
+		def value=(val)
+			@value = val
+			@size = @value.nil? ? 0 : @value.size
+			@active = (@size > 0)
+		end
+	end
+
+	class Int16LE < Field
+		def initialize(opt)
+			super(opt)
+			@size = 2
+		end
+
+		def parse(str, offset=0)
+			if @active and str.size >= offset + @size
+				@value = str[offset, @size].unpack("v")[0]
+				@size
+			else
+		  		0
+			end
+		end
+	      
+		def serialize
+			[@value].pack("v")
+		end
+	end
+
+	class Int32LE < Field
+		def initialize(opt)
+			super(opt)
+			@size = 4
+		end
+
+		def parse(str, offset=0)
+			if @active and str.size >= offset + @size
+				@value = str.slice(offset, @size).unpack("V")[0]
+				@size
+			else
+				0
+			end
+		end
+
+		def serialize
+			[@value].pack("V") if @active
+		end
+	end
+
+	class Int64LE < Field
+		def initialize(opt)
+			super(opt)
+			@size = 8
+		end
+
+		def parse(str, offset=0)
+			if @active and str.size >= offset + @size
+				d, u = str.slice(offset, @size).unpack("V2")
+				@value = (u * 0x100000000 + d)
+				@size
+			else
+				0
+			end
+		end
+	      
+		def serialize
+			[@value & 0x00000000ffffffff, @value >> 32].pack("V2") if @active
+		end
+	end
+
+	# base class of data structure
+	class FieldSet
+		class << FieldSet
+		def define(&block)
+			c = Class.new(self)
+			def c.inherited(subclass)
+				proto = @proto
+				subclass.instance_eval {
+					@proto = proto
+					}
+			end
+			c.module_eval(&block)
+			c
+		end
+		
+		def string(name, opts)
+			add_field(name, String, opts)
+		end
+		
+		def int16LE(name, opts)
+			add_field(name, Int16LE, opts)
+		end
+
+		def int32LE(name, opts)
+			add_field(name, Int32LE, opts)
+		end
+
+		def int64LE(name, opts)
+			add_field(name, Int64LE, opts)
+		end
+		
+		def security_buffer(name, opts)
+			add_field(name, SecurityBuffer, opts)
+		end
+
+		def prototypes
+			@proto
+		end
+		
+		def names
+			@proto.map{|n, t, o| n}
+		end
+
+		def types
+			@proto.map{|n, t, o| t}
+		end
+		
+		def opts
+			@proto.map{|n, t, o| o}
+		end
+		
+		private
+		
+		def add_field(name, type, opts)
+			(@proto ||= []).push [name, type, opts]
+			define_accessor name
+		end
+		
+		def define_accessor(name)
+			module_eval(<<-End, __FILE__, __LINE__ + 1)
+			def #{name}
+				self['#{name}'].value
+			end
+		    
+			def #{name}=(val)
+				self['#{name}'].value = val
+			end
+			End
+		end 
+		end #self
+      
+		def initialize
+			@alist = self.class.prototypes.map{ |n, t, o| [n, t.new(o)] }
+		end
+	      
+		def serialize
+			@alist.map{|n, f| f.serialize }.join
+		end
+	      
+		def parse(str, offset=0)
+			@alist.inject(offset){|cur, a|  cur += a[1].parse(str, cur)}
+		end
+
+		def size
+			@alist.inject(0){|sum, a| sum += a[1].size}
+		end
+
+		def [](name)
+			a = @alist.assoc(name.to_s.intern)
+			raise ArgumentError, "no such field: #{name}" unless a
+			a[1]
+		end
+	      
+		def []=(name, val)
+			a = @alist.assoc(name.to_s.intern)
+			raise ArgumentError, "no such field: #{name}" unless a
+			a[1] = val
+		end
+	      
+		def enable(name)
+			self[name].active = true
+		end
+	      
+		def disable(name)
+			self[name].active = false
+		end
+	end
+
+	Blob = FieldSet.define {
+		int32LE    :blob_signature,   {:value => CONST::BLOB_SIGN}
+		int32LE    :reserved,         {:value => 0}
+		int64LE    :timestamp,      {:value => 0}
+		string     :challenge,      {:value => "", :size => 8}
+		int32LE    :unknown1,     {:value => 0}
+		string     :target_info,      {:value => "", :size => 0}
+		int32LE    :unknown2,         {:value => 0}
+	}
+
+	SecurityBuffer = FieldSet.define {
+		int16LE   :length,        {:value => 0}
+		int16LE   :allocated,     {:value => 0}
+		int32LE   :offset,        {:value => 0}
+	}
+
+
+	class SecurityBuffer
+		attr_accessor :active
+		def initialize(opts)
+			super()
+			@value  = opts[:value]
+			@active = opts[:active].nil? ? true : opts[:active]
+			@size = 8
+		end
+	      
+		def parse(str, offset=0)
+			if @active and str.size >= offset + @size
+				super(str, offset)
+				@value = str[self.offset, self.length]
+				@size
+			else
+				0
+			end
+		end
+	      
+		def serialize
+			super if @active
+		end
+	      
+		def value
+			@value
+		end
+	      
+		def value=(val)
+			@value = val
+			self.length = self.allocated = val.size
+		end
+	      
+		def data_size
+			@active ? @value.size : 0
+		end
+	end
+end
+end
+end
+end